@promptowl/contextnest-community 1.25.0 → 1.26.0

package/dist/index.js

@@ -38,7 +38,7 @@ import {
   submitForReview,
   withNodeWriteLock,
   withdrawDeletionRequest
-} from "./chunk-DTLMBF4W.js";
+} from "./chunk-M6PGYMBD.js";
 import {
   canCreateInNest,
   canManageStewards,
@@ -59,7 +59,7 @@ import {
   stewardDocumentCreator,
   syncFromConfig,
   updateSteward
-} from "./chunk-2KHM5C7V.js";
+} from "./chunk-DGPTJXIV.js";
 import {
   createGrant,
   deleteGrant,
@@ -68,16 +68,7 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-KPGNZLZL.js";
-import {
-  generateApiKey,
-  getKeyPrefix,
-  hashApiKey,
-  hashPassword,
-  parseBearerToken,
-  verifyKeyRequest,
-  verifyPassword
-} from "./chunk-F66VCBLA.js";
+} from "./chunk-RPGFHESR.js";
 import {
   attributeRequest,
   checkConflict,
@@ -101,7 +92,7 @@ import {
   serializeClient,
   setApprovedVersion,
   upsertVersion
-} from "./chunk-TI7HMP64.js";
+} from "./chunk-IEAWRHMV.js";
 import {
   approveExternalEdit,
   getExternalEditDetail,
@@ -113,7 +104,7 @@ import {
   scanDocumentForDrift,
   scanNestForDrift,
   startDriftScanner
-} from "./chunk-32SZCH36.js";
+} from "./chunk-2QOJE7A5.js";
 import {
   addMember,
   addWatcher,
@@ -121,10 +112,7 @@ import {
   assertSafeNodeId,
   buildDocContext,
   buildTitleMap,
-  canApproveWith,
-  canEditWith,
   capForArchive,
-  collabPermToRole,
   createNest,
   createTeam,
   deleteNest,
@@ -147,7 +135,6 @@ import {
   insertOrIgnore,
   installLicenseKey,
   isConfigSuperAdmin,
-  isEmailConfigured,
   isLicenseAdminEmail,
   isLicenseAdminUserId,
   isNestArchived,
@@ -186,7 +173,6 @@ import {
   persistSetting,
   pinNest,
   pinnedNestIds,
-  primaryRole,
   readIndexedNodes,
   rebuildNodeIndex,
   removeMember,
@@ -202,7 +188,6 @@ import {
   resolveNodeUrl,
   resolveTeamRolesForUser,
   restoreNest,
-  sendEmailToRecipient,
   setAllowSelfApprove,
   setCreatorIsReviewer,
   setPrimeOnlyReview,
@@ -219,9 +204,8 @@ import {
   unpinNest,
   unshareTeamFromNest,
   updateMemberRole,
-  validateLicense,
-  verifySmtp
-} from "./chunk-7FROMOZM.js";
+  validateLicense
+} from "./chunk-SWA5M5XX.js";
 import {
   AppError,
   ConflictError,
@@ -234,13 +218,34 @@ import {
   VaultBusyError,
   isVaultLockTimeout
 } from "./chunk-LHWOJPFE.js";
+import {
+  createInvitedUser,
+  findOrCreateInvitedUser,
+  generateApiKey,
+  getKeyPrefix,
+  hashApiKey,
+  hashPassword,
+  parseBearerToken,
+  verifyKeyRequest,
+  verifyPassword
+} from "./chunk-PICUHQEM.js";
+import {
+  canApproveWith,
+  canEditWith,
+  collabPermToRole,
+  isEmailConfigured,
+  primaryRole,
+  sendEmailToRecipient,
+  transportSettings,
+  verifyEmailTransport
+} from "./chunk-I5EDEZBQ.js";
 import {
   config,
   getDb,
   initDb,
   isEmailListish,
   isEmailish
-} from "./chunk-JDAOA5KP.js";
+} from "./chunk-TRSGPS27.js";
 import {
   ANON_EMAIL,
   ANON_USER_ID,
@@ -254,9 +259,9 @@ import {
 import { serve } from "@hono/node-server";
 
 // src/app.ts
-import { Hono as Hono26 } from "hono";
+import { Hono as Hono27 } from "hono";
 import { LinearRouter } from "hono/router/linear-router";
-import { createMiddleware as createMiddleware2 } from "hono/factory";
+import { createMiddleware as createMiddleware3 } from "hono/factory";
 import { cors } from "hono/cors";
 
 // src/shared/artifact-sandbox.ts
@@ -473,6 +478,84 @@ var authMiddleware = createMiddleware(async (c, next) => {
   );
 });
 
+// src/auth/nest-scope-guard.ts
+import { createMiddleware as createMiddleware2 } from "hono/factory";
+var NEST_SCOPED_KEY_CODE = "nest_scoped_key";
+var PUBLIC_PATHS = /* @__PURE__ */ new Set([
+  "/health",
+  "/license/status",
+  "/llms.txt",
+  "/auth/admin-status"
+]);
+function segmentMatches(seg, nestId) {
+  if (seg === nestId) return true;
+  try {
+    return decodeURIComponent(seg) === nestId;
+  } catch {
+    return false;
+  }
+}
+function nestKeyVerdict(method, rawPath, scope) {
+  const path = rawPath.length > 1 ? rawPath.replace(/\/+$/, "") : rawPath;
+  const isGet = method === "GET" || method === "HEAD";
+  if (PUBLIC_PATHS.has(path) && isGet) return { allowed: true };
+  if (path === "/mcp") return { allowed: true };
+  if (path === "/index" && isGet) return { allowed: true };
+  if ((path === "/search" || path === "/stats" || path === "/nests") && isGet) {
+    return { allowed: true };
+  }
+  if (path.startsWith("/runs/")) return { allowed: true };
+  const m = /^\/nests\/([^/]+)(\/.*)?$/.exec(path);
+  if (m) {
+    if (segmentMatches(m[1], scope)) return { allowed: true };
+    return {
+      allowed: false,
+      reason: "other_nest",
+      mcpTransport: m[2] === "/mcp"
+    };
+  }
+  return { allowed: false, reason: "outside_nest" };
+}
+async function bearerKeyScope(authorization) {
+  const key = parseBearerToken(authorization);
+  if (!key) return null;
+  const row = await getDb().get(
+    "SELECT nest_id FROM api_keys WHERE key_hash = ?",
+    [hashApiKey(key)]
+  );
+  return row?.nest_id ?? null;
+}
+var nestScopedKeyGuard = createMiddleware2(async (c, next) => {
+  const scope = await bearerKeyScope(c.req.header("Authorization"));
+  if (!scope) return next();
+  const verdict = nestKeyVerdict(c.req.method, c.req.path, scope);
+  if (verdict.allowed) return next();
+  const sessionId = getSessionIdFromRequest(c);
+  if (sessionId && await resolveSession(sessionId)) return next();
+  if (verdict.reason === "other_nest") {
+    const error = `API key not authorized for this nest \u2014 this key is scoped to nest "${scope}". Use that nest's MCP URL, or mint a user-level key in the Connect dialog.`;
+    if (verdict.mcpTransport) {
+      let id = null;
+      try {
+        id = (await c.req.json())?.id ?? null;
+      } catch {
+      }
+      return c.json(
+        { jsonrpc: "2.0", id, error: { code: -32e3, message: error } },
+        403
+      );
+    }
+    return c.json({ error, code: NEST_SCOPED_KEY_CODE }, 403);
+  }
+  return c.json(
+    {
+      error: "This API key is scoped to one nest and can't reach account-wide or server-wide routes (API keys, admin, teams, people, your inbox). Use a key for all your nests for those.",
+      code: NEST_SCOPED_KEY_CODE
+    },
+    403
+  );
+});
+
 // src/shared/rate-limit.ts
 var buckets = /* @__PURE__ */ new Map();
 function liveBucket(key, cutoff) {
@@ -1310,7 +1393,7 @@ authRoutes.post("/register", async (c) => {
   if (config.MANUAL_SIGN_IN !== "open") {
     return c.json(
       {
-        error: "Self-registration is disabled on this server. If you were invited, use \u201CSet your password\u201D to activate your account. Otherwise ask your admin for an invite."
+        error: "Self-registration is disabled on this server. If you were invited, sign in with the temporary password from your invite email, or continue with PromptOwl using that email. Otherwise ask your admin for an invite."
       },
       403
     );
@@ -1337,7 +1420,7 @@ authRoutes.post("/register", async (c) => {
     if (existing.is_invited === 1) {
       return c.json(
         {
-          error: "You've been invited to this server. Ask your admin for your temporary password, then sign in and change it \u2014 you can't set it here."
+          error: "You've been invited to this server. Sign in with the temporary password from your invite email, or continue with PromptOwl using this email. Your admin can reset the password if you don't have it."
         },
         409
       );
@@ -1434,10 +1517,36 @@ authRoutes.post("/logout", async (c) => {
   );
   return c.json({ ok: true });
 });
+function refuseNestScopedCaller(c) {
+  if (!c.get("nestScope")) return null;
+  return c.json(
+    {
+      error: "This API key is scoped to one nest and can't create, rotate, list or revoke API keys. Use a key for all your nests, or the web app.",
+      code: NEST_SCOPED_KEY_CODE
+    },
+    403
+  );
+}
+async function checkKeyNest(userId, nestId) {
+  if (typeof nestId !== "string" || !nestId.trim()) {
+    return { error: "nest_id must be a nest id.", status: 400 };
+  }
+  const row = await getDb().get("SELECT id FROM nests WHERE id = ?", [nestId]);
+  const reachable = !!row && (config.AUTH_MODE === "open" || await resolveNestPermission(nestId, userId) !== "none");
+  if (!reachable) {
+    return {
+      error: "Nest not found \u2014 you can only scope a key to a nest you have access to.",
+      status: 404
+    };
+  }
+  return null;
+}
 authRoutes.post("/keys", authMiddleware, async (c) => {
   const body = await c.req.json().catch(
     () => ({})
   );
+  const refused = refuseNestScopedCaller(c);
+  if (refused) return refused;
   const db = getDb();
   const userId = c.get("userId");
   const check = await verifyKeyRequest(db, userId, {
@@ -1445,6 +1554,10 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
     label: body.label
   });
   if (!check.ok) return c.json({ error: check.error }, check.status);
+  if (body.nest_id) {
+    const bad = await checkKeyNest(userId, body.nest_id);
+    if (bad) return c.json({ error: bad.error }, bad.status);
+  }
   const apiKey = generateApiKey();
   const keyId = uuid4();
   await db.run(
@@ -1459,12 +1572,20 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
     ]
   );
   return c.json(
-    { id: keyId, api_key: apiKey, key_prefix: getKeyPrefix(apiKey), label: check.label },
+    {
+      id: keyId,
+      api_key: apiKey,
+      key_prefix: getKeyPrefix(apiKey),
+      label: check.label,
+      nest_id: body.nest_id || null
+    },
     201
   );
 });
 authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
   const body = await c.req.json().catch(() => ({}));
+  const refused = refuseNestScopedCaller(c);
+  if (refused) return refused;
   const db = getDb();
   const userId = c.get("userId");
   const check = await verifyKeyRequest(db, userId, {
@@ -1474,6 +1595,10 @@ authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
   });
   if (!check.ok) return c.json({ error: check.error }, check.status);
   const prior = check.key;
+  if ("nest_id" in body && body.nest_id) {
+    const bad = await checkKeyNest(userId, body.nest_id);
+    if (bad) return c.json({ error: bad.error }, bad.status);
+  }
   const apiKey = generateApiKey();
   const keyId = uuid4();
   const nestScope = "nest_id" in body ? body.nest_id || null : prior.nest_id;
@@ -1506,10 +1631,13 @@ authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
     id: keyId,
     api_key: apiKey,
     key_prefix: getKeyPrefix(apiKey),
-    label: check.label ?? prior.label
+    label: check.label ?? prior.label,
+    nest_id: nestScope
   });
 });
 authRoutes.get("/keys", authMiddleware, async (c) => {
+  const refused = refuseNestScopedCaller(c);
+  if (refused) return refused;
   const db = getDb();
   const userId = c.get("userId");
   const check = await verifyKeyRequest(db, userId, { action: "fetch" });
@@ -1521,6 +1649,8 @@ authRoutes.get("/keys", authMiddleware, async (c) => {
   return c.json({ keys });
 });
 authRoutes.delete("/keys/:keyId", authMiddleware, async (c) => {
+  const refused = refuseNestScopedCaller(c);
+  if (refused) return refused;
   const db = getDb();
   const userId = c.get("userId");
   const check = await verifyKeyRequest(db, userId, {
@@ -1904,47 +2034,30 @@ authRoutes.post("/invite", async (c) => {
     "SELECT id, email, is_invited FROM users WHERE LOWER(email) = ?",
     [email]
   );
-  if (existing && existing.is_invited === 0) {
+  if (existing) {
     return c.json(
       {
-        error: "A user with this email already exists. Use Reset password to issue them a new password."
+        error: existing.is_invited === 0 ? `${email} is already a member of this server.` : `${email} is already invited but hasn't signed in yet. Use Reset password on their row to issue a new temporary password.`
       },
       409
     );
   }
-  const tempPassword = uuid4().replace(/-/g, "").slice(0, 16);
-  const passwordHash = await hashPassword(tempPassword);
-  let userId;
-  if (existing) {
-    userId = existing.id;
-    await db.run("UPDATE users SET password_hash = ? WHERE id = ?", [
-      passwordHash,
-      userId
-    ]);
-  } else {
-    userId = uuid4();
-    await db.run(
-      "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-      [userId, email, null, passwordHash]
-    );
-  }
-  trackEvent("admin.invite", { adminId: callerId, email });
   const inviter = await db.get("SELECT email FROM users WHERE id = ?", [
     callerId
   ]);
-  void sendEmailToRecipient(email, {
-    status: "invited",
-    docTitle: "ContextNest",
-    path: "",
-    actor: email,
-    by: inviter?.email || void 0,
-    tempPassword,
-    link: requestBaseUrl(c.req.url)
+  const { id: userId, tempPassword } = await createInvitedUser(email, {
+    invitedBy: inviter?.email,
+    baseUrl: requestBaseUrl(c.req.url)
   });
+  trackEvent("admin.invite", { adminId: callerId, email });
   return c.json(
     {
       temporary_password: tempPassword,
       user: { id: userId, email },
+      // PromptOwl sign-in only counts as an option for them when it's open to all.
+      promptowl_sign_in: config.PROMPTOWL_SIGN_IN_GATE === "open",
+      // Email is configured, so the invite email (with this password) went out.
+      emailed: isEmailConfigured(),
       message: "Share this temporary password securely. Your teammate signs in with their email + this password, then can change it and create their own API key."
     },
     201
@@ -1972,7 +2085,12 @@ authRoutes.get("/teammates", async (c) => {
   const teammates = await db.all(
     `SELECT u.id, u.email, u.name, u.is_invited,
          (SELECT COUNT(*) FROM api_keys WHERE user_id = u.id) as key_count,
-         (SELECT MAX(last_used_at) FROM api_keys WHERE user_id = u.id) as last_active
+         -- Latest of API-key use and web-session activity (same text format).
+         (SELECT MAX(t) FROM (
+            SELECT last_used_at AS t FROM api_keys WHERE user_id = u.id
+            UNION ALL
+            SELECT last_seen_at FROM sessions WHERE user_id = u.id
+          ) activity) as last_active
        FROM users u
        WHERE u.id != ?
        ORDER BY u.created_at DESC`,
@@ -2930,7 +3048,7 @@ async function vaultFolderPaths(nestId, opts = {}) {
   });
   return entries.map(
     (e) => prefix && e.path.startsWith(`${prefix}/`) ? e.path.slice(prefix.length + 1) : e.path
-  ).filter(Boolean);
+  ).filter((p) => p && !(!prefix && (p === "assets" || p.startsWith("assets/"))));
 }
 async function listNestFolders(nestId, opts = {}) {
   if (opts.folder !== void 0) assertSafeFolder(opts.folder);
@@ -3908,6 +4026,7 @@ async function vaultFolderDir(nestId, rel) {
 }
 async function vaultFolderExists(nestId, rel) {
   if (!rel) return false;
+  assertSafeFolder(rel);
   try {
     return (await stat(await vaultFolderDir(nestId, rel))).isDirectory();
   } catch {
@@ -4066,14 +4185,14 @@ async function syncUnsyncedFolder(userId, folderName, callerEmail, client) {
   if (isNestStorageRoot(src)) {
     throw new ValidationError("Folder is not eligible for sync");
   }
-  let stat2;
+  let stat3;
   try {
-    stat2 = statSync(src);
+    stat3 = statSync(src);
   } catch {
     console.warn(`[unsynced] source missing: ${src}`);
     throw new NotFoundError(`Folder not found: ${folderName}`);
   }
-  if (!stat2.isDirectory()) {
+  if (!stat3.isDirectory()) {
     throw new ValidationError(`Not a directory: ${folderName}`);
   }
   const files = collectMarkdownFiles(src, src);
@@ -4122,19 +4241,226 @@ async function deleteUnsyncedFolder(folderName) {
   if (isNestStorageRoot(src)) {
     throw new ValidationError("Folder is not eligible for delete");
   }
-  let stat2;
+  let stat3;
   try {
-    stat2 = statSync(src);
+    stat3 = statSync(src);
   } catch {
     throw new NotFoundError(`Folder not found: ${folderName}`);
   }
-  if (!stat2.isDirectory()) {
+  if (!stat3.isDirectory()) {
     throw new ValidationError(`Not a directory: ${folderName}`);
   }
   await rm2(src, { recursive: true, force: true });
   console.log(`[unsynced] deleted folder ${src}`);
 }
 
+// src/shared/branding.ts
+import { z } from "zod";
+var HEX_RE = /^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/;
+var IMAGE_EXT_RE = /\.(?:png|jpe?g|gif|webp)$/i;
+var ASSET_NAME_RE = /^[0-9a-f-]{36}\.(?:png|jpe?g|gif|webp)$/;
+var BRANDING_LIMITS = {
+  site_title: 120,
+  banner_headline: 120,
+  banner_subtext: 280,
+  footer_text: 280,
+  footer_link_label: 80,
+  url: 2048
+};
+var IMAGE_FIELDS = ["logo_url", "banner_url", "favicon_url"];
+var COLOR_FIELDS = ["accent_color", "header_bg_color", "page_tint_color"];
+var CONTROL_RE = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/;
+var optText = (max) => z.string().max(max).refine((s) => !CONTROL_RE.test(s), "must not contain control characters").nullable().optional();
+var optColor = z.string().regex(HEX_RE, "must be a #rgb or #rrggbb hex color").nullable().optional();
+var optUrl = z.string().max(BRANDING_LIMITS.url).nullable().optional();
+var BrandingSchema = z.strictObject({
+  logo_url: optUrl,
+  banner_url: optUrl,
+  banner_headline: optText(BRANDING_LIMITS.banner_headline),
+  banner_subtext: optText(BRANDING_LIMITS.banner_subtext),
+  accent_color: optColor,
+  header_bg_color: optColor,
+  page_tint_color: optColor,
+  site_title: optText(BRANDING_LIMITS.site_title),
+  footer_text: optText(BRANDING_LIMITS.footer_text),
+  footer_link_url: optUrl,
+  footer_link_label: optText(BRANDING_LIMITS.footer_link_label),
+  favicon_url: optUrl,
+  hide_powered_by: z.boolean().optional()
+});
+function nestAssetName(url, nestId) {
+  const prefix = `/nests/${nestId}/assets/`;
+  if (!url.startsWith(prefix)) return null;
+  const name = url.slice(prefix.length);
+  return ASSET_NAME_RE.test(name) ? name : null;
+}
+function isHttpsImageUrl(url) {
+  if (!/^https:\/\//i.test(url)) return false;
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return false;
+  }
+  if (u.protocol !== "https:" || u.username || u.password || !u.hostname) return false;
+  return IMAGE_EXT_RE.test(u.pathname);
+}
+function isHttpsLink(url) {
+  if (!/^https:\/\//i.test(url)) return false;
+  try {
+    const u = new URL(url);
+    return u.protocol === "https:" && !u.username && !u.password && !!u.hostname;
+  } catch {
+    return false;
+  }
+}
+function normalizeHex(v) {
+  if (typeof v !== "string" || !HEX_RE.test(v)) return null;
+  let h = v.slice(1).toLowerCase();
+  if (h.length === 3) h = h.split("").map((c) => c + c).join("");
+  return "#" + h;
+}
+function compact(b) {
+  const out = {};
+  for (const [k, v] of Object.entries(b)) {
+    if (v === null || v === void 0) continue;
+    if (typeof v === "string") {
+      const t = v.trim();
+      if (t === "") continue;
+      out[k] = t;
+    } else if (v === true) {
+      out[k] = true;
+    }
+  }
+  if (Object.keys(out).length === 0) return null;
+  return out;
+}
+var BrandingValidationError = class extends Error {
+};
+async function validateBrandingInput(body, nestId, assetExists) {
+  if (body === null || body === void 0) return null;
+  const parsed = BrandingSchema.safeParse(body);
+  if (!parsed.success) {
+    const issue = parsed.error.issues[0];
+    const field2 = issue?.path?.join(".") || "branding";
+    const msg = issue?.code === "unrecognized_keys" ? `unknown branding field(s): ${issue.keys.join(", ")}` : `${field2}: ${issue?.message ?? "invalid"}`;
+    throw new BrandingValidationError(msg);
+  }
+  const b = compact(parsed.data);
+  if (!b) return null;
+  for (const f of COLOR_FIELDS) {
+    if (b[f]) b[f] = normalizeHex(b[f]);
+  }
+  for (const f of IMAGE_FIELDS) {
+    const url = b[f];
+    if (!url) continue;
+    const asset = nestAssetName(url, nestId);
+    if (asset) {
+      if (!await assetExists(asset)) {
+        throw new BrandingValidationError(`${f}: no such asset in this nest`);
+      }
+      continue;
+    }
+    if (!isHttpsImageUrl(url)) {
+      throw new BrandingValidationError(
+        `${f}: must be an image uploaded to this nest or an https:// URL ending in .png, .jpg, .gif or .webp`
+      );
+    }
+    b[f] = new URL(url).href;
+  }
+  if (b.footer_link_url) {
+    if (!isHttpsLink(b.footer_link_url)) {
+      throw new BrandingValidationError("footer_link_url: must be an https:// URL");
+    }
+    b.footer_link_url = new URL(b.footer_link_url).href;
+  }
+  return b;
+}
+function parseStoredBranding(raw, nestId) {
+  if (!raw) return null;
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const parsed = BrandingSchema.safeParse(data);
+  if (!parsed.success) return null;
+  const b = compact(parsed.data);
+  if (!b) return null;
+  for (const f of IMAGE_FIELDS) {
+    const url = b[f];
+    if (url && !nestAssetName(url, nestId) && !isHttpsImageUrl(url)) delete b[f];
+  }
+  if (b.footer_link_url && !isHttpsLink(b.footer_link_url)) delete b.footer_link_url;
+  const kept = compact(b);
+  if (!kept) return null;
+  return { ...kept, hide_powered_by: kept.hide_powered_by === true };
+}
+function rgb(hex) {
+  const h = normalizeHex(hex).slice(1);
+  return [0, 2, 4].map((i) => parseInt(h.slice(i, i + 2), 16));
+}
+function toHex([r, g, b]) {
+  return "#" + [r, g, b].map((n) => Math.round(Math.max(0, Math.min(255, n))).toString(16).padStart(2, "0")).join("");
+}
+function relativeLuminance(hex) {
+  const [r, g, b] = rgb(hex).map((v) => {
+    const c = v / 255;
+    return c <= 0.03928 ? c / 12.92 : Math.pow((c + 0.055) / 1.055, 2.4);
+  });
+  return 0.2126 * r + 0.7152 * g + 0.0722 * b;
+}
+function contrastRatio(a, b) {
+  const la = relativeLuminance(a);
+  const lb = relativeLuminance(b);
+  return (Math.max(la, lb) + 0.05) / (Math.min(la, lb) + 0.05);
+}
+function readableForeground(bg) {
+  return contrastRatio("#000000", bg) >= contrastRatio("#ffffff", bg) ? "#000000" : "#ffffff";
+}
+function mixHex(a, b, weight) {
+  const ca = rgb(a);
+  const cb = rgb(b);
+  return toHex([0, 1, 2].map((i) => ca[i] * weight + cb[i] * (1 - weight)));
+}
+function ensureContrast(fg, bg, min = 4.5) {
+  const start = normalizeHex(fg);
+  if (contrastRatio(start, bg) >= min) return start;
+  const target = readableForeground(bg);
+  for (let w = 0.05; w <= 1.0001; w += 0.05) {
+    const c = mixHex(target, start, w);
+    if (contrastRatio(c, bg) >= min) return c;
+  }
+  return target;
+}
+function publishBrandCssVars(b) {
+  if (!b) return "";
+  const decls = [];
+  const tint = normalizeHex(b.page_tint_color);
+  const page = tint ? mixHex(tint, "#ffffff", 0.1) : "#ffffff";
+  const accent = normalizeHex(b.accent_color);
+  if (accent) {
+    const text = ensureContrast(ensureContrast(accent, page), "#ffffff");
+    decls.push(
+      `--cn-accent:${accent}`,
+      `--cn-accent-fg:${readableForeground(accent)}`,
+      `--cn-accent-text:${text}`
+    );
+  }
+  const header = normalizeHex(b.header_bg_color);
+  if (header) decls.push(`--cn-header-bg:${header}`, `--cn-header-fg:${readableForeground(header)}`);
+  if (tint) decls.push(`--cn-page-bg:${page}`);
+  return decls.length ? `:root{${decls.join(";")}}` : "";
+}
+function cssUrl(url) {
+  const safe = url.replace(
+    /["'()\\\s\u0000-\u001f\u007f]/g,
+    (ch) => "%" + ch.charCodeAt(0).toString(16).padStart(2, "0").toUpperCase()
+  );
+  return `url("${safe}")`;
+}
+
 // src/nests/routes.ts
 async function effectiveAccess(nestId, userId) {
   const access = await resolveNestAccess(nestId, userId);
@@ -4157,6 +4483,11 @@ function isGrantOnly(access) {
   return access.permission === "none" && access.hasGrant;
 }
 var nestRoutes = new Hono3();
+function withParsedBranding(nest) {
+  if (!nest) return nest;
+  const { branding_json, ...rest } = nest;
+  return { ...rest, branding: parseStoredBranding(branding_json, nest.id) };
+}
 nestRoutes.get("/", async (c) => {
   const userId = c.get("userId");
   const archivedOnly = c.req.query("archived") === "1";
@@ -4212,9 +4543,11 @@ nestRoutes.get("/", async (c) => {
       pinned: pinned.has(n.id)
     };
   };
+  const nestScope = c.get("nestScope");
   const seen = /* @__PURE__ */ new Set();
   const deduped = [];
   for (const n of [...owned, ...shared, ...publicExtras]) {
+    if (nestScope && n.id !== nestScope) continue;
     if (seen.has(n.id)) continue;
     seen.add(n.id);
     deduped.push(n);
@@ -4279,7 +4612,7 @@ nestRoutes.get("/", async (c) => {
       }
     }
   }
-  const withMeta = out.map(
+  const withMeta = out.map((raw) => withParsedBranding(raw)).map(
     (n) => n.grant_only ? {
       ...n,
       document_count: grantedDocsByNest.get(n.id) ?? 0,
@@ -4305,7 +4638,7 @@ nestRoutes.post("/", async (c) => {
     throw new ValidationError("name is required");
   }
   const nest = await createNest(c.get("userId"), body.name, body.description);
-  return c.json({ nest }, 201);
+  return c.json({ nest: withParsedBranding(nest) }, 201);
 });
 nestRoutes.post("/:nestId", async (c) => {
   if (c.req.param("nestId") !== "import") {
@@ -4323,7 +4656,7 @@ nestRoutes.post("/:nestId", async (c) => {
     const email2 = await resolveCallerEmail(userId);
     if (body.finalize) {
       return c.json({
-        nest: nest2,
+        nest: withParsedBranding(nest2),
         documents: await registerImportedDocuments(
           target,
           email2,
@@ -4354,14 +4687,14 @@ nestRoutes.post("/:nestId", async (c) => {
   try {
     const { rejected } = await stageImportedFiles(nest.id, files, email);
     if (body.partial) {
-      return c.json({ nest, rejected }, 201);
+      return c.json({ nest: withParsedBranding(nest), rejected }, 201);
     }
     const documents = await registerImportedDocuments(
       nest.id,
       email,
       attributeRequest(c, body.client)
     );
-    return c.json({ nest, documents, rejected }, 201);
+    return c.json({ nest: withParsedBranding(nest), documents, rejected }, 201);
   } catch (err) {
     await deleteNest(nest.id).catch(() => {
     });
@@ -4427,7 +4760,7 @@ nestRoutes.get("/:nestId", async (c) => {
   const grant_only = roles.length === 0 && isGrantOnly(access);
   const nest = await getNest(nestId);
   return c.json({
-    nest,
+    nest: withParsedBranding(nest),
     permission,
     roles: grant_only ? ["viewer"] : roles,
     myStewards,
@@ -4451,7 +4784,7 @@ nestRoutes.patch("/:nestId", async (c) => {
     name: body.name,
     description: body.description
   });
-  return c.json({ nest });
+  return c.json({ nest: withParsedBranding(nest) });
 });
 nestRoutes.post("/:nestId/pin", async (c) => {
   const nestId = c.req.param("nestId");
@@ -4594,21 +4927,10 @@ async function addCollaborator(params) {
     if (!isEmailish(params.email)) {
       throw new ValidationError("Enter a valid email address.");
     }
-    const email = normalizeEmail(params.email);
-    const existing = await db.get(
-      "SELECT id FROM users WHERE LOWER(email) = ?",
-      [email]
-    );
-    if (existing) {
-      userId = existing.id;
-    } else {
-      const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
-      userId = uuid6();
-      await db.run(
-        "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-        [userId, email, null, await hashPassword2(uuid6())]
-      );
-    }
+    userId = (await findOrCreateInvitedUser(params.email, {
+      invitedBy: params.grantedByEmail,
+      baseUrl: params.baseUrl
+    })).id;
   }
   if (!userId) {
     throw new ValidationError("user_id or email is required");
@@ -4667,13 +4989,18 @@ async function addCollaborator(params) {
     // event. Slack/Teams still fire.
     { skipEmail: true }
   );
-  const inviteeEmail = params.email || (await db.get("SELECT email FROM users WHERE id = ?", [userId]))?.email;
+  const invitee = await db.get(
+    "SELECT email, is_invited FROM users WHERE id = ?",
+    [userId]
+  );
+  const inviteeEmail = params.email || invitee?.email;
   if (inviteeEmail) {
+    const nestLink = docLink(nestId, void 0, params.baseUrl);
     void sendEmailToRecipient(inviteeEmail, {
       status: "shared",
       docTitle: shareNestName,
       path: shareNestName,
-      link: docLink(nestId, void 0, params.baseUrl),
+      link: nestLink && invitee?.is_invited === 1 ? `${nestLink}&invite=${encodeURIComponent(inviteeEmail)}` : nestLink,
       actor: inviteeEmail,
       permission: params.permission,
       by: params.grantedByEmail || void 0
@@ -4867,10 +5194,78 @@ sharingRoutes.patch("/reader-mode", async (c) => {
   });
 });
 
-// src/nests/grant-routes.ts
+// src/nests/branding-routes.ts
 import { Hono as Hono5 } from "hono";
-import { v4 as uuid7 } from "uuid";
-var grantRoutes = new Hono5();
+import { access as fsAccess } from "fs/promises";
+import { join as join3 } from "path";
+var brandingRoutes = new Hono5();
+brandingRoutes.patch("/branding", async (c) => {
+  const userId = c.get("userId");
+  const nestId = c.req.param("nestId");
+  const isServerAdmin = config.AUTH_MODE === "open" || await isServerAdminUserId(userId);
+  if (!isServerAdmin) {
+    const access = await resolveNestAccess(nestId, userId);
+    if (permissionLevel(access.permission) < permissionLevel("admin")) {
+      throw new ForbiddenError(
+        "Only the nest owner, a nest admin, or the server admin can change branding"
+      );
+    }
+  }
+  const db = getDb();
+  if (!await db.get("SELECT id FROM nests WHERE id = ?", [nestId])) {
+    throw new NotFoundError("Nest not found");
+  }
+  const text = await c.req.text();
+  let body = null;
+  if (text.trim() !== "") {
+    try {
+      body = JSON.parse(text);
+    } catch {
+      throw new ValidationError("body must be JSON");
+    }
+  }
+  if (body !== null && (typeof body !== "object" || Array.isArray(body))) {
+    throw new ValidationError("branding must be an object or null");
+  }
+  const assetsDir = join3(resolveNestPath(nestId), "assets");
+  let next;
+  try {
+    next = await validateBrandingInput(body, nestId, async (name) => {
+      try {
+        await fsAccess(join3(assetsDir, name));
+        return true;
+      } catch {
+        return false;
+      }
+    });
+  } catch (err) {
+    if (err instanceof BrandingValidationError) throw new ValidationError(err.message);
+    throw err;
+  }
+  const mentionsHide = body !== null && Object.prototype.hasOwnProperty.call(body, "hide_powered_by");
+  const stored = await db.transaction(async (tx) => {
+    const lock = db.dialect === "postgres" ? " FOR UPDATE" : "";
+    const row = await tx.get(`SELECT branding_json FROM nests WHERE id = ?${lock}`, [nestId]);
+    if (!row) throw new NotFoundError("Nest not found");
+    const wasHidden = parseStoredBranding(row.branding_json, nestId)?.hide_powered_by === true;
+    if (!isServerAdmin) {
+      if (next?.hide_powered_by === true && !wasHidden) {
+        throw new ForbiddenError(
+          'Only the server admin can hide the "Powered by ContextNest" line'
+        );
+      }
+      if (!mentionsHide && wasHidden) next = { ...next ?? {}, hide_powered_by: true };
+    }
+    const value = next ? JSON.stringify(next) : null;
+    await tx.run("UPDATE nests SET branding_json = ? WHERE id = ?", [value, nestId]);
+    return value;
+  });
+  return c.json({ branding: parseStoredBranding(stored, nestId) });
+});
+
+// src/nests/grant-routes.ts
+import { Hono as Hono6 } from "hono";
+var grantRoutes = new Hono6();
 async function requireManage(c, nestId, opts = {}) {
   if (config.AUTH_MODE === "open") return;
   const access = await resolveNestAccess(nestId, c.get("userId"));
@@ -4886,17 +5281,8 @@ async function requireManage(c, nestId, opts = {}) {
   }
 }
 async function resolveGrantee(email) {
-  const db = getDb();
-  const e = normalizeEmail(email);
-  const existing = await db.get("SELECT id FROM users WHERE LOWER(email) = ?", [e]);
-  if (existing) return existing.id;
-  const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
-  const id = uuid7();
-  await db.run(
-    "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-    [id, e, null, await hashPassword2(uuid7())]
-  );
-  return id;
+  const { findOrCreateInvitedUser: findOrCreateInvitedUser2 } = await import("./invited-user-AM6A3WGO.js");
+  return (await findOrCreateInvitedUser2(email)).id;
 }
 async function assertGrantAddsAccess(params) {
   const { nestId, email, userId, targetType, target, role } = params;
@@ -4993,10 +5379,10 @@ grantRoutes.delete("/:id", async (c) => {
 });
 
 // src/nests/publish-routes.ts
-import { Hono as Hono6 } from "hono";
+import { Hono as Hono7 } from "hono";
 
 // src/nests/publish-service.ts
-import { v4 as uuid8 } from "uuid";
+import { v4 as uuid7 } from "uuid";
 import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
 var MODES = ["public", "email", "code", "invite"];
 var LINK_TTL_SECONDS = 60 * 60;
@@ -5065,7 +5451,7 @@ async function createPublish(params) {
     );
   }
   const db = getDb();
-  const id = uuid8();
+  const id = uuid7();
   const slug = newSlug();
   const created = nowIso();
   const codeHash = mode === "code" && params.code ? await hashPassword(params.code.trim()) : null;
@@ -5096,7 +5482,7 @@ async function createPublish(params) {
       await db.run(
         `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
          VALUES (?, ?, 'invite', ?, NULL, NULL, NULL, ?)`,
-        [uuid8(), id, email, created]
+        [uuid7(), id, email, created]
       );
     }
   }
@@ -5151,7 +5537,7 @@ async function mintMagicLink(publishId, email) {
   await getDb().run(
     `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
      VALUES (?, ?, 'link', ?, ?, ?, NULL, ?)`,
-    [uuid8(), publishId, e, sha256Hex(token), expires, nowIso()]
+    [uuid7(), publishId, e, sha256Hex(token), expires, nowIso()]
   );
   return token;
 }
@@ -5181,7 +5567,7 @@ async function createSession2(publishId, email) {
   await getDb().run(
     `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
      VALUES (?, ?, 'session', ?, ?, ?, NULL, ?)`,
-    [uuid8(), publishId, email, sha256Hex(token), expires, nowIso()]
+    [uuid7(), publishId, email, sha256Hex(token), expires, nowIso()]
   );
   return token;
 }
@@ -5198,7 +5584,7 @@ async function logView(publishId, email) {
   await getDb().run(
     `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
      VALUES (?, ?, 'view', ?, NULL, NULL, NULL, ?)`,
-    [uuid8(), publishId, email, nowIso()]
+    [uuid7(), publishId, email, nowIso()]
   );
 }
 async function listAllowlist(publishId) {
@@ -5216,7 +5602,7 @@ async function listViews(publishId) {
 }
 
 // src/nests/publish-routes.ts
-var publishRoutes = new Hono6();
+var publishRoutes = new Hono7();
 async function requireManage2(c, nestId) {
   if (!await canManageStewards(nestId, c.get("userId"))) {
     throw new ForbiddenError(
@@ -5231,7 +5617,7 @@ publishRoutes.post("/", async (c) => {
   const mode = body.access_mode ?? "public";
   if ((mode === "email" || mode === "invite") && !isEmailConfigured()) {
     throw new ValidationError(
-      "Email and invite links need email set up on this server (SMTP_URL and NOTIFY_EMAIL_FROM). Use a public or passcode link instead."
+      "Email and invite links need email set up on this server (SMTP or AWS SES, plus NOTIFY_EMAIL_FROM). Use a public or passcode link instead."
     );
   }
   const row = await createPublish({
@@ -5287,11 +5673,11 @@ publishRoutes.delete("/:id", async (c) => {
 });
 
 // src/nests/publish-render-routes.ts
-import { Hono as Hono7 } from "hono";
+import { Hono as Hono8 } from "hono";
 import MarkdownIt from "markdown-it";
 
 // src/annotations/service.ts
-import { v4 as uuid9 } from "uuid";
+import { v4 as uuid8 } from "uuid";
 
 // src/annotations/projection.ts
 var MAX_CONTEXT_CHARS = 250;
@@ -5445,7 +5831,7 @@ async function createThread(nestId, nodeId, input, authorEmail) {
     throw new Error("comment body is required");
   }
   const db = getDb();
-  const id = uuid9();
+  const id = uuid8();
   const anchor = clampAnchor(input.anchor);
   const snapshot = input.snapshotVersion ?? await getApprovedVersion(nestId, nodeId) ?? null;
   await db.transaction(async (tx) => {
@@ -5465,7 +5851,7 @@ async function createThread(nestId, nodeId, input, authorEmail) {
     await tx.run(
       `INSERT INTO annotation_comments (id, thread_id, author, body, created_at)
        VALUES (?, ?, ?, ?, ${nowMsExpr(db)})`,
-      [uuid9(), id, authorEmail, body]
+      [uuid8(), id, authorEmail, body]
     );
   });
   return rowToThread(await getThreadRow(id));
@@ -5487,7 +5873,7 @@ async function addComment(nestId, nodeId, threadId, authorEmail, body) {
   await db.run(
     `INSERT INTO annotation_comments (id, thread_id, author, body, created_at)
      VALUES (?, ?, ?, ?, ${nowMsExpr(db)})`,
-    [uuid9(), threadId, authorEmail, trimmed]
+    [uuid8(), threadId, authorEmail, trimmed]
   );
   return rowToThread(await getThreadRow(threadId));
 }
@@ -5608,7 +5994,9 @@ async function syncAnnotationsNode(nestId, nodeId, userEmail) {
 }
 
 // src/nests/publish-render-routes.ts
-var publishRenderRoutes = new Hono7();
+import { readFile, stat as stat2 } from "fs/promises";
+import { join as join4 } from "path";
+var publishRenderRoutes = new Hono8();
 var SESSION_TTL_SECONDS2 = 24 * 60 * 60;
 var GATE_LIMIT = { max: 10, windowMs: 10 * 6e4 };
 var COMMENT_LIMIT = { max: 5, windowMs: 10 * 6e4 };
@@ -5665,6 +6053,114 @@ function setSessionCookie2(c, slug, token) {
 function esc(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
+var IMAGE_MIME = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp"
+};
+var INLINE_CAP = { logo: 512 * 1024, favicon: 256 * 1024, banner: 2 * 1024 * 1024 };
+var INLINE_CACHE_MAX_CHARS = 24 * 1024 * 1024;
+var inlineCache = /* @__PURE__ */ new Map();
+var inlineCacheChars = 0;
+function cacheGet(key) {
+  if (!inlineCache.has(key)) return void 0;
+  const v = inlineCache.get(key);
+  inlineCache.delete(key);
+  inlineCache.set(key, v);
+  return v;
+}
+function cachePut(key, v) {
+  const size = v?.length ?? 0;
+  if (size > INLINE_CACHE_MAX_CHARS) return;
+  inlineCacheChars -= inlineCache.get(key)?.length ?? 0;
+  inlineCache.set(key, v);
+  inlineCacheChars += size;
+  for (const [k, old] of inlineCache) {
+    if (inlineCacheChars <= INLINE_CACHE_MAX_CHARS && inlineCache.size <= 512) break;
+    inlineCache.delete(k);
+    inlineCacheChars -= old?.length ?? 0;
+  }
+}
+async function inlineAsset(nestId, url, cap) {
+  if (!url) return null;
+  const name = nestAssetName(url, nestId);
+  if (!name) return null;
+  const key = `${nestId}/${name}/${cap}`;
+  const hit = cacheGet(key);
+  if (hit !== void 0) return hit;
+  let out = null;
+  try {
+    const path = join4(resolveNestPath(nestId), "assets", name);
+    if ((await stat2(path)).size <= cap) {
+      const mime = IMAGE_MIME[name.split(".").pop().toLowerCase()];
+      if (mime) out = `data:${mime};base64,${(await readFile(path)).toString("base64")}`;
+    }
+  } catch {
+    return null;
+  }
+  cachePut(key, out);
+  return out;
+}
+async function loadBrand(row) {
+  let b = null;
+  try {
+    const r = await getDb().get("SELECT branding_json FROM nests WHERE id = ?", [row.nest_id]);
+    b = parseStoredBranding(r?.branding_json, row.nest_id);
+  } catch {
+    b = null;
+  }
+  if (!b) return null;
+  const [logo, banner, favicon] = await Promise.all([
+    inlineAsset(row.nest_id, b.logo_url, INLINE_CAP.logo),
+    inlineAsset(row.nest_id, b.banner_url, INLINE_CAP.banner),
+    inlineAsset(row.nest_id, b.favicon_url, INLINE_CAP.favicon)
+  ]);
+  return { b, logo, banner, favicon };
+}
+var BRAND_CSS = `
+  .cn-brand{display:flex;align-items:center;gap:12px;padding:12px 24px;background:var(--cn-header-bg,#fff);color:var(--cn-header-fg,#1c1917);border-bottom:1px solid rgba(0,0,0,.08);font:600 16px/1.3 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif}
+  .cn-brand img{height:32px;width:auto;max-width:160px;object-fit:contain}
+  .cn-brand span{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+  .cn-hero{position:relative;min-height:120px;max-height:220px;height:28vw;display:flex;flex-direction:column;justify-content:flex-end;padding:20px 24px;box-sizing:border-box;background:var(--cn-accent,#142a80) center/cover no-repeat;color:var(--cn-accent-fg,#fff);overflow:hidden}
+  .cn-hero.has-img{color:#fff}
+  .cn-hero.has-img::before{content:"";position:absolute;inset:0;background:linear-gradient(to top,rgba(0,0,0,.62),rgba(0,0,0,.08))}
+  .cn-hero *{position:relative;margin:0;max-width:820px}
+  .cn-hero strong{display:block;font:700 clamp(20px,4vw,30px)/1.2 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif}
+  .cn-hero p{margin-top:6px;font-size:15px;opacity:.92}
+  .cn-foot{max-width:820px;margin:0 auto;padding:20px 24px 40px;border-top:1px solid #e7e5e4;color:#78716c;font-size:13px;display:flex;flex-wrap:wrap;gap:6px 16px}
+  .cn-foot a{color:var(--cn-accent-text,#142a80)}
+`;
+function brandHead(brand, extraCss = "") {
+  if (!brand) return "";
+  const icon = brand.favicon ? `<link rel="icon" href="${esc(brand.favicon)}">` : "";
+  return `<style>${publishBrandCssVars(brand.b)}${BRAND_CSS}${extraCss}</style>${icon}`;
+}
+function brandBar(brand) {
+  if (!brand) return "";
+  const title = brand.b.site_title ? `<span>${esc(brand.b.site_title)}</span>` : "";
+  const logo = brand.logo ? `<img src="${esc(brand.logo)}" alt="">` : "";
+  if (!title && !logo) return "";
+  return `<header class="cn-brand">${logo}${title}</header>`;
+}
+function brandHero(brand) {
+  if (!brand) return "";
+  const { banner_headline: h, banner_subtext: sub } = brand.b;
+  if (!brand.banner && !h) return "";
+  const style = brand.banner ? ` style="background-image:${esc(cssUrl(brand.banner))}"` : "";
+  const cls = brand.banner ? "cn-hero has-img" : "cn-hero";
+  return `<div class="${cls}"${style}>${h ? `<strong>${esc(h)}</strong>` : ""}${sub ? `<p>${esc(sub)}</p>` : ""}</div>`;
+}
+function brandFooter(brand) {
+  if (!brand) return "";
+  const { footer_text: text, footer_link_url: href, footer_link_label: label } = brand.b;
+  const parts = [];
+  if (text) parts.push(`<span>${esc(text)}</span>`);
+  if (href) parts.push(`<a href="${esc(href)}" rel="noopener noreferrer" target="_blank">${esc(label || href)}</a>`);
+  if (!brand.b.hide_powered_by) parts.push(`<span>Secured by PromptOwl \xB7 ContextNest</span>`);
+  return parts.length ? `<footer class="cn-foot">${parts.join("")}</footer>` : "";
+}
 var NO_DOWNLOAD_CSS = `<style>
   @media print{html,body{display:none !important}}
   html,body{-webkit-user-select:none;-ms-user-select:none;user-select:none}
@@ -5736,7 +6232,10 @@ async function renderPublished(c, row, viewerEmail) {
   }
   const title = esc(artifact.title || row.node_id);
   const heading = /^\s*#\s/.test(body) ? "" : `<h1>${title}</h1>`;
-  const shell = `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${title}</title><style>${PROSE_CSS}</style></head><body><main>${heading}${markdown.render(body)}</main>${overlays}</body></html>`;
+  const brand = await loadBrand(row);
+  const docTitle = brand?.b.site_title ? `${title} \xB7 ${esc(brand.b.site_title)}` : title;
+  const brandCss = brand ? `body{background:var(--cn-page-bg,#fff)}h1,h2,h3,h4,a{color:var(--cn-accent-text,#142a80)}` : "";
+  const shell = `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${docTitle}</title><style>${PROSE_CSS}</style>${brandHead(brand, brandCss)}</head><body>${brandBar(brand)}${brandHero(brand)}<main>${heading}${markdown.render(body)}</main>${brandFooter(brand)}${overlays}</body></html>`;
   return c.body(shell, 200, { "Content-Type": "text/html; charset=utf-8" });
 }
 var EYE_SVG = `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M2 12s3.6-7 10-7 10 7 10 7-3.6 7-10 7-10-7-10-7Z"/><circle cx="12" cy="12" r="3"/></svg>`;
@@ -5757,7 +6256,27 @@ var GATE_EYE_SCRIPT = `<script>
     });
   })();
 </script>`;
-function gatePage(row, message) {
+var GATE_BRAND_CSS = `
+    body{background:var(--cn-page-bg,#f4f4f5)}
+    .card{box-sizing:border-box;overflow:hidden}
+    h1{color:var(--cn-accent-text,#142a80)}
+    button[type=submit]{background:var(--cn-accent,#142a80);color:var(--cn-accent-fg,#fff)}
+    .cn-brand{margin:-32px -34px 20px;border-radius:14px 14px 0 0;padding:14px 20px}
+    .cn-gate-foot{font-size:12px;color:#a8a29e;margin:10px 0 0;text-align:center}
+    .cn-gate-foot a{color:var(--cn-accent-text,#142a80)}
+`;
+function gateBrandTop(brand) {
+  return brandBar(brand);
+}
+function gateBrandFoot(brand) {
+  if (!brand) return "";
+  const { footer_text: text, footer_link_url: href, footer_link_label: label } = brand.b;
+  const parts = [];
+  if (text) parts.push(esc(text));
+  if (href) parts.push(`<a href="${esc(href)}" rel="noopener noreferrer" target="_blank">${esc(label || href)}</a>`);
+  return parts.length ? `<p class="cn-gate-foot">${parts.join(" \xB7 ")}</p>` : "";
+}
+function gatePage(row, message, brand = null) {
   const wantsCode = row.access_mode === "code";
   const field2 = wantsCode ? `<label>Access code<span class="wrap">
         <input id="cn-code" name="code" type="password" autocomplete="off" required autofocus>
@@ -5782,10 +6301,10 @@ function gatePage(row, message) {
     button.eye svg{width:18px;height:18px;display:block}
     .err{color:#be123c;font-weight:600}
     .brand{font-size:12px;color:#a8a29e;margin:18px 0 0;text-align:center}
-  </style></head><body><form class="card" method="POST" action="/p/${esc(row.slug)}/gate">
-    <h1>Protected document</h1><p>${esc(note)}</p>${err}${field2}
+  </style>${brandHead(brand, GATE_BRAND_CSS)}</head><body><form class="card" method="POST" action="/p/${esc(row.slug)}/gate">
+    ${gateBrandTop(brand)}<h1>Protected document</h1><p>${esc(note)}</p>${err}${field2}
     <button type="submit">${cta}</button>
-    <p class="brand">Secured by PromptOwl \xB7 ContextNest</p>
+    ${brand?.b.hide_powered_by ? "" : `<p class="brand">Secured by PromptOwl \xB7 ContextNest</p>`}${gateBrandFoot(brand)}
   </form>${wantsCode ? GATE_EYE_SCRIPT : ""}</body></html>`;
 }
 function unavailablePage() {
@@ -5804,7 +6323,7 @@ function unavailablePage() {
 function sentPage() {
   return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Check your email</title><style>body{margin:0;min-height:100vh;display:grid;place-items:center;background:#f4f4f5;color:#1c1917;font:16px/1.55 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif}.card{background:#fff;border:1px solid #e7e5e4;border-radius:14px;box-shadow:0 4px 24px rgba(20,42,128,.08);padding:32px 34px;max-width:380px;text-align:center}h1{font-size:20px;color:#142a80;margin:0 0 6px}p{color:#78716c;margin:0;font-size:14px}</style></head><body><div class="card"><h1>Check your email</h1><p>If your address has access, a one-time link to open this document is on its way.</p></div></body></html>`;
 }
-function readerShell(row, title, viewerEmail) {
+function readerShell(row, title, viewerEmail, brand = null) {
   const emailField = viewerEmail ? `<p class="who">Commenting as <strong>${esc(viewerEmail)}</strong></p>` : `<label>Your email<input id="cn-email" type="email" autocomplete="email" required></label>`;
   return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${esc(title)}</title><style>
     html,body{margin:0;height:100%}
@@ -5825,7 +6344,7 @@ function readerShell(row, title, viewerEmail) {
     button[disabled]{opacity:.6;cursor:default}
     .msg{font-weight:600;margin:0 0 14px;font-size:14px}
     .msg.err{color:#be123c}.msg.ok{color:#15803d}
-  </style></head><body>
+  </style>${brand ? `<style>${publishBrandCssVars(brand.b)}#cn-open,#cn-send{background:var(--cn-accent,#142a80);color:var(--cn-accent-fg,#fff)}.card h2{color:var(--cn-accent-text,#142a80)}</style>` : ""}</head><body>
     <iframe id="cn-frame" src="/p/${esc(row.slug)}/view" title="${esc(title)}"></iframe>
     <button id="cn-open" type="button">Leave a comment</button>
     <div id="cn-back"><div class="card" role="dialog" aria-modal="true" aria-label="Leave a comment">
@@ -5896,12 +6415,12 @@ publishRenderRoutes.get("/:slug", async (c) => {
   const row = await getPublishBySlug(slug);
   if (!isLivePublish(row)) return c.html(unavailablePage(), 404);
   const viewer = await resolveViewer(c, row);
-  if (!viewer) return c.html(gatePage(row));
+  if (!viewer) return c.html(gatePage(row, void 0, await loadBrand(row)));
   if (row.comments_enabled !== 1) return renderPublished(c, row, viewer.email);
   const title = await publishedTitle(row);
   c.header("Content-Security-Policy", SHELL_CSP);
   c.header("Referrer-Policy", "no-referrer");
-  return c.html(readerShell(row, title, viewer.email));
+  return c.html(readerShell(row, title, viewer.email, await loadBrand(row)));
 });
 publishRenderRoutes.get("/:slug/view", async (c) => {
   const slug = c.req.param("slug");
@@ -5939,20 +6458,20 @@ publishRenderRoutes.post("/:slug/gate", async (c) => {
   const row = await getPublishBySlug(slug);
   if (!isLivePublish(row)) return c.html(unavailablePage(), 404);
   if (!tryConsume(`publish-gate:${slug}:${clientIp(c)}`, GATE_LIMIT)) {
-    return c.html(gatePage(row, "Too many attempts. Try again in a few minutes."), 429);
+    return c.html(gatePage(row, "Too many attempts. Try again in a few minutes.", await loadBrand(row)), 429);
   }
   if (row.access_mode === "public") return c.redirect(`/p/${slug}`);
   const form = await c.req.parseBody();
   if (row.access_mode === "code") {
     if (!await verifyCode(row, String(form.code ?? ""))) {
-      return c.html(gatePage(row, "That code is not correct."), 401);
+      return c.html(gatePage(row, "That code is not correct.", await loadBrand(row)), 401);
     }
     setSessionCookie2(c, slug, await createSession2(row.id, null));
     return c.redirect(`/p/${slug}`);
   }
   const email = normalizeEmail(String(form.email ?? ""));
   if (!isEmailish(email)) {
-    return c.html(gatePage(row, "Enter a valid email address."), 400);
+    return c.html(gatePage(row, "Enter a valid email address.", await loadBrand(row)), 400);
   }
   const allowed = row.access_mode !== "invite" || await isAllowlisted(row.id, email);
   const linkToken = await mintMagicLink(row.id, email);
@@ -5972,15 +6491,15 @@ publishRenderRoutes.get("/:slug/verify", async (c) => {
   if (!isLivePublish(row)) return c.html(unavailablePage(), 404);
   const email = await consumeMagicLink(row.id, c.req.query("token") ?? "");
   if (!email) {
-    return c.html(gatePage(row, "That link is invalid or has expired. Request a new one."), 401);
+    return c.html(gatePage(row, "That link is invalid or has expired. Request a new one.", await loadBrand(row)), 401);
   }
   setSessionCookie2(c, slug, await createSession2(row.id, email));
   return c.redirect(`/p/${slug}`);
 });
 
 // src/nests/nest-team-routes.ts
-import { Hono as Hono8 } from "hono";
-var nestTeamRoutes = new Hono8();
+import { Hono as Hono9 } from "hono";
+var nestTeamRoutes = new Hono9();
 nestTeamRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const refs = await listNestTeams(nestId);
@@ -6019,8 +6538,8 @@ nestTeamRoutes.delete("/:teamId", async (c) => {
 });
 
 // src/nests/people-routes.ts
-import { Hono as Hono9 } from "hono";
-var peopleRoutes = new Hono9();
+import { Hono as Hono10 } from "hono";
+var peopleRoutes = new Hono10();
 peopleRoutes.get("/suggest", async (c) => {
   const userId = c.get("userId");
   const q = c.req.query("q") ?? "";
@@ -6030,7 +6549,7 @@ peopleRoutes.get("/suggest", async (c) => {
 });
 
 // src/governance/team-routes.ts
-import { Hono as Hono10 } from "hono";
+import { Hono as Hono11 } from "hono";
 
 // src/governance/promptowl-teams.ts
 var PROMPTOWL_SOURCE = "promptowl";
@@ -6177,7 +6696,7 @@ async function desiredRoster(poTeam, callerEmail) {
 }
 
 // src/governance/team-routes.ts
-var teamRoutes = new Hono10();
+var teamRoutes = new Hono11();
 var PROMPTOWL_LIMIT = { max: 10, windowMs: 15 * 6e4 };
 var CONNECT_REQUIRED = "promptowl_connect_required";
 var CONNECT_REQUIRED_STATUS = 428;
@@ -6362,7 +6881,7 @@ function toSearchHit(node, query) {
 }
 
 // src/nodes/routes.ts
-import { Hono as Hono11 } from "hono";
+import { Hono as Hono12 } from "hono";
 import { parseDocument as parseDocument3, readPdfBinary as readPdfBinary2 } from "@promptowl/contextnest-engine";
 
 // src/nodes/markdown-export.ts
@@ -6415,7 +6934,7 @@ ${m[1]}
 }
 
 // src/nodes/routes.ts
-var nodeRoutes = new Hono11();
+var nodeRoutes = new Hono12();
 function nodeAsMarkdown(response, nodeId) {
   return nodeToMarkdown({
     id: nodeId,
@@ -6498,7 +7017,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-S22V2JKG.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-TDZUC2Q6.js");
   const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -6519,7 +7038,7 @@ nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-4G2XUFS6.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-2EWN7WWO.js");
   const history = await getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -6798,13 +7317,13 @@ async function getUserEmail(c) {
 }
 
 // src/annotations/routes.ts
-import { Hono as Hono12 } from "hono";
+import { Hono as Hono13 } from "hono";
 
 // src/annotations/types.ts
 var ARTIFACT_NODE_TYPE = "artifact";
 
 // src/annotations/routes.ts
-var annotationRoutes = new Hono12();
+var annotationRoutes = new Hono13();
 function getNodeId(c) {
   const raw = c.req.param("nodeId");
   try {
@@ -6932,7 +7451,7 @@ annotationRoutes.get("/:nodeId{.+}/hosted", async (c) => {
 });
 
 // src/nodes/query-routes.ts
-import { Hono as Hono13 } from "hono";
+import { Hono as Hono14 } from "hono";
 
 // src/tables/service.ts
 function splitCsvLine(line) {
@@ -7392,7 +7911,7 @@ async function resolveExportBody(nestId, nodeId, workingBody) {
 
 // src/nests/bundle-service.ts
 import { readdirSync as readdirSync2, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
-import { join as join3, sep } from "path";
+import { join as join5, sep } from "path";
 import JSZip from "jszip";
 import { serializeDocument as serializeDocument2 } from "@promptowl/contextnest-engine";
 function walkFiles(root) {
@@ -7405,7 +7924,7 @@ function walkFiles(root) {
   }
   for (const rel of entries) {
     try {
-      if (statSync2(join3(root, rel)).isFile()) out.push(rel.split(sep).join("/"));
+      if (statSync2(join5(root, rel)).isFile()) out.push(rel.split(sep).join("/"));
     } catch {
     }
   }
@@ -7446,13 +7965,17 @@ async function exportNestBundle(nestId, includeDrafts) {
     const segs = rel.split("/");
     const keep = segs.includes(".versions") || rel === ".context/config.yaml" || rel === "CONTEXT.md";
     if (!keep) continue;
-    zip.file(rel, readFileSync2(join3(nestPath, rel)));
+    zip.file(rel, readFileSync2(join5(nestPath, rel)));
   }
   trackEvent("nest.export.bundle", { nestId, documents: count, includeDrafts });
   return zip.generateAsync({ type: "arraybuffer" });
 }
 
 // src/nodes/graph-service.ts
+import {
+  contextLinkTarget,
+  extractContextLinks
+} from "@promptowl/contextnest-engine";
 var MAX_GRAPH_NODES = 150;
 var WIKILINK_RE = /\[\[([^\]|]+)(?:\|([^\]]+))?\]\]/g;
 function bareSlug(idOrTarget) {
@@ -7470,6 +7993,15 @@ function extractWikiTargets(body) {
   }
   return out;
 }
+function extractContextTargets(body) {
+  const out = /* @__PURE__ */ new Set();
+  if (!body) return [];
+  for (const uri of extractContextLinks(body)) {
+    const t = contextLinkTarget(uri);
+    if (t) out.add(t);
+  }
+  return [...out];
+}
 async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
   const { storage } = await engineCache.get(nestId);
   const docs = (await storage.discoverDocuments()).filter(
@@ -7504,6 +8036,15 @@ async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
       allLinks.push({ source: d.id, target: targetId });
     }
   }
+  for (const d of accessible) {
+    for (const targetId of extractContextTargets(d.body || "")) {
+      if (!idSet.has(targetId) || targetId === d.id) continue;
+      const key = `${d.id}->${targetId}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      allLinks.push({ source: d.id, target: targetId });
+    }
+  }
   const tagCounts = /* @__PURE__ */ new Map();
   const tagToDocs = /* @__PURE__ */ new Map();
   for (const n of allNodes) {
@@ -7616,7 +8157,7 @@ async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
 }
 
 // src/nodes/query-routes.ts
-var queryRoutes = new Hono13();
+var queryRoutes = new Hono14();
 queryRoutes.get("/changes", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
@@ -7820,7 +8361,10 @@ queryRoutes.post("/context", async (c) => {
     hopsUsed = result.hopsUsed;
     nodesTraversed = result.nodesTraversed;
   }
-  if (titleMatches.length > 0 && hops > 0) {
+  const hopSeeds = [
+    ...new Map([...documents, ...titleMatches].map((d) => [d.id, d])).values()
+  ];
+  if (hopSeeds.length > 0 && hops > 0) {
     const byTitle = new Map(
       allDocs.map((d) => [
         String(d.frontmatter.title || "").toLowerCase(),
@@ -7838,9 +8382,13 @@ queryRoutes.post("/context", async (c) => {
         const t = byId.get(target) ?? byTitle.get(target.toLowerCase());
         if (t && t.id !== d.id) link(d.id, t.id);
       }
+      for (const target of extractContextTargets(d.body || "")) {
+        const t = byId.get(target);
+        if (t && t.id !== d.id) link(d.id, t.id);
+      }
     }
-    const seen = new Set(titleMatches.map((d) => d.id));
-    let frontier = titleMatches.map((d) => d.id);
+    const seen = new Set(hopSeeds.map((d) => d.id));
+    let frontier = hopSeeds.map((d) => d.id);
     for (let depth = 0; depth < hops && frontier.length; depth++) {
       const next = [];
       for (const id of frontier) {
@@ -8207,7 +8755,7 @@ queryRoutes.post("/publish", async (c) => {
 });
 
 // src/mcp/routes.ts
-import { Hono as Hono15 } from "hono";
+import { Hono as Hono16 } from "hono";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 
@@ -8297,10 +8845,10 @@ async function listTraceEvents(filters = {}) {
 }
 
 // src/mcp/workflow-tools.ts
-import { v4 as uuid12 } from "uuid";
+import { v4 as uuid11 } from "uuid";
 
 // src/workflow/run-service.ts
-import { v4 as uuid10 } from "uuid";
+import { v4 as uuid9 } from "uuid";
 var RUNNABLE_TYPES = ["agent", "skill"];
 async function flowSubgraph(nestId, agentNode) {
   const db = getDb();
@@ -8430,7 +8978,7 @@ async function triggerRun(opts) {
   }
   const edges = await flowSubgraph(nestId, agentNode);
   const definitions = await referencedDefinitions(nestId, edges);
-  const id = `run_${uuid10()}`;
+  const id = `run_${uuid9()}`;
   const db = getDb();
   await db.transaction(async (tx) => {
     if (parentRunId) {
@@ -8616,8 +9164,8 @@ async function listRuns(nestId, opts) {
 }
 
 // src/workflow/edge-routes.ts
-import { Hono as Hono14 } from "hono";
-import { v4 as uuid11 } from "uuid";
+import { Hono as Hono15 } from "hono";
+import { v4 as uuid10 } from "uuid";
 function toResponse(e, t) {
   return {
     id: e.id,
@@ -8735,7 +9283,7 @@ async function assertNoDuplicateEdge(db, nestId, fromNode, toNode, type, exclude
     );
   }
 }
-var edgeRoutes = new Hono14();
+var edgeRoutes = new Hono15();
 edgeRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -8803,7 +9351,7 @@ edgeRoutes.post("/", requireWorkflowPlane, async (c) => {
   );
   const metadata = body.metadata === void 0 || body.metadata === null ? null : JSON.stringify(body.metadata);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = uuid11();
+  const id = uuid10();
   await db.transaction(async (tx) => {
     await assertNoDuplicateEdge(tx, nestId, fromNode, toNode, type);
     if (type.is_flow) {
@@ -9204,7 +9752,7 @@ async function createEdge(ctx, args) {
   );
   const metadata = args.metadata === void 0 || args.metadata === null ? null : JSON.stringify(args.metadata);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = uuid12();
+  const id = uuid11();
   await db.transaction(async (tx) => {
     await assertNoDuplicateEdge(tx, ctx.nestId, fromNode, toNode, type);
     if (type.is_flow) {
@@ -9268,7 +9816,7 @@ async function upsertEdgeType(ctx, args) {
         `INSERT INTO edge_types
            (id, nest_id, name, description, direction, is_flow, condition_schema, color, created_by, created_at, updated_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-        [uuid12(), ctx.nestId, name, args.description.trim(), direction, isFlow, conditionSchema, color, definedBy, now, now]
+        [uuid11(), ctx.nestId, name, args.description.trim(), direction, isFlow, conditionSchema, color, definedBy, now, now]
       );
     }
   });
@@ -10922,22 +11470,12 @@ ${list}`,
       if (!target) return "target is required (a node id or folder prefix).";
       if (!["read", "write"].includes(role)) return "role must be read or write.";
       try {
-        const { createGrant: createGrant2 } = await import("./grants-service-2OTFS7EH.js");
-        const db = (await import("./client-D44ZHDTJ.js")).getDb();
+        const { createGrant: createGrant2 } = await import("./grants-service-24GLUBY4.js");
         const { normalizeEmail: normalizeEmail2 } = await import("./email-R7DFS6E5.js");
         const e = normalizeEmail2(String(args.email || ""));
         if (!e) return "email is required.";
-        let row = await db.get("SELECT id FROM users WHERE LOWER(email) = ?", [e]);
-        if (!row) {
-          const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
-          const { v4: uuid20 } = await import("uuid");
-          const id = uuid20();
-          await db.run(
-            "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-            [id, e, null, await hashPassword2(uuid20())]
-          );
-          row = { id };
-        }
+        const { findOrCreateInvitedUser: findOrCreateInvitedUser2 } = await import("./invited-user-AM6A3WGO.js");
+        const row = await findOrCreateInvitedUser2(e, { invitedBy: ctx.userEmail });
         await createGrant2({
           nestId: ctx.nestId,
           targetType,
@@ -10989,8 +11527,8 @@ ${list}`;
 }
 
 // src/mcp/routes.ts
-import { z } from "zod";
-var mcpRoutes = new Hono15();
+import { z as z2 } from "zod";
+var mcpRoutes = new Hono16();
 async function getUserEmail2(userId) {
   const db = getDb();
   const user = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
@@ -11008,10 +11546,10 @@ function createMcpServerForNest(nestId, userId, userEmail, baseUrl, c) {
     const shape = {};
     for (const [key, def] of Object.entries(props)) {
       let field2;
-      if (def.type === "string") field2 = z.string();
-      else if (def.type === "number") field2 = z.number();
-      else if (def.type === "array") field2 = z.array(z.string());
-      else field2 = z.any();
+      if (def.type === "string") field2 = z2.string();
+      else if (def.type === "number") field2 = z2.number();
+      else if (def.type === "array") field2 = z2.array(z2.string());
+      else field2 = z2.any();
       if (!required.includes(key)) field2 = field2.optional();
       shape[key] = field2;
     }
@@ -11060,8 +11598,8 @@ mcpRoutes.all("/", async (c) => {
 });
 
 // src/workflow/run-routes.ts
-import { Hono as Hono16 } from "hono";
-import { v4 as uuid13 } from "uuid";
+import { Hono as Hono17 } from "hono";
+import { v4 as uuid12 } from "uuid";
 var RUNNABLE_TYPES2 = ["agent", "skill"];
 var safeJson2 = (s) => {
   if (!s) return null;
@@ -11179,7 +11717,7 @@ async function buildRunBundle(nestId, agentNode) {
     definitions
   };
 }
-var runTriggerRoutes = new Hono16();
+var runTriggerRoutes = new Hono17();
 async function resolveParentRun2(nestId, parentRunId, childAgent) {
   if (!config.FEATURE_SUBAGENT_RUNS) {
     throw new ValidationError(
@@ -11258,7 +11796,7 @@ runTriggerRoutes.post("/:agentNode{.+}", requireWorkflowPlane, async (c) => {
   }
   const bundle = await buildRunBundle(nestId, agentNode);
   const triggeredBy = await resolveCallerEmail(c.get("userId"));
-  const id = `run_${uuid13()}`;
+  const id = `run_${uuid12()}`;
   await getDb().run(
     `INSERT INTO runs (id, nest_id, agent_node, triggered_by, status, inputs, started_at, parent_run_id, depth)
      VALUES (?, ?, ?, ?, 'running', ?, ?, ?, ?)`,
@@ -11287,7 +11825,7 @@ runTriggerRoutes.post("/:agentNode{.+}", requireWorkflowPlane, async (c) => {
     201
   );
 });
-var runListRoutes = new Hono16();
+var runListRoutes = new Hono17();
 runListRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -11319,7 +11857,7 @@ runListRoutes.get("/", requireWorkflowPlane, async (c) => {
     }))
   });
 });
-var runDetailRoutes = new Hono16();
+var runDetailRoutes = new Hono17();
 async function loadRunWithPermission(c, runId, required) {
   const run = await getDb().get("SELECT * FROM runs WHERE id = ?", [
     runId
@@ -11470,8 +12008,8 @@ runDetailRoutes.get("/:id", requireWorkflowPlane, async (c) => {
 });
 
 // src/workflow/schedule-routes.ts
-import { Hono as Hono17 } from "hono";
-import { v4 as uuid14 } from "uuid";
+import { Hono as Hono18 } from "hono";
+import { v4 as uuid13 } from "uuid";
 var RUNNABLE_TYPES3 = ["agent", "skill"];
 var MIN_EVERY = 5;
 var MAX_EVERY = 7 * 24 * 60;
@@ -11508,7 +12046,7 @@ function parseEvery(v) {
   }
   return n;
 }
-var scheduleRoutes = new Hono17();
+var scheduleRoutes = new Hono18();
 scheduleRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const rows = await getDb().all(
@@ -11549,7 +12087,7 @@ scheduleRoutes.post("/", requireWorkflowPlane, async (c) => {
     );
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = `sch_${uuid14()}`;
+  const id = `sch_${uuid13()}`;
   await db.run(
     `INSERT INTO schedules (id, nest_id, agent_node, every_minutes, enabled, last_run_at, max_runs, runs_created, created_by, created_at, updated_at)
      VALUES (?, ?, ?, ?, ?, NULL, ?, 0, ?, ?, ?)`,
@@ -11604,8 +12142,8 @@ scheduleRoutes.delete("/:id", requireWorkflowPlane, async (c) => {
 });
 
 // src/notify/connector-routes.ts
-import { Hono as Hono18 } from "hono";
-import { v4 as uuid15 } from "uuid";
+import { Hono as Hono19 } from "hono";
+import { v4 as uuid14 } from "uuid";
 var KNOWN_EVENTS = [
   "review_requested",
   "review_approved",
@@ -11652,7 +12190,7 @@ function parseUrl(v) {
     'url must be a public https:// URL (loopback/private/metadata hosts are refused) or an env reference like "env:SLACK_WEBHOOK"'
   );
 }
-var connectorRoutes = new Hono18();
+var connectorRoutes = new Hono19();
 connectorRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const rows = await getDb().all(
@@ -11671,7 +12209,7 @@ connectorRoutes.post("/", async (c) => {
   const url = parseUrl(body.url);
   const events = parseEvents(body.events);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = `con_${uuid15()}`;
+  const id = `con_${uuid14()}`;
   await getDb().run(
     `INSERT INTO connectors (id, nest_id, channel, url, events, enabled, created_by, created_at, updated_at)
      VALUES (?, ?, ?, ?, ?, 1, ?, ?, ?)`,
@@ -11714,7 +12252,7 @@ connectorRoutes.delete("/:id", async (c) => {
 });
 
 // src/workflow/hook-routes.ts
-import { Hono as Hono19 } from "hono";
+import { Hono as Hono20 } from "hono";
 import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2, randomUUID } from "crypto";
 var PRESETS = ["slack", "teams", "webhook"];
 var RUNNABLE_TYPES4 = ["agent", "skill"];
@@ -11737,7 +12275,7 @@ function toResponse4(c, r, opts = {}) {
     created_at: r.created_at
   };
 }
-var hookNestRoutes = new Hono19();
+var hookNestRoutes = new Hono20();
 hookNestRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const agent = c.req.query("agent");
@@ -11811,7 +12349,7 @@ function teamsSignatureValid(secret, authHeader, rawBody) {
 function stripMentions(text) {
   return text.replace(/<@[^>]+>/g, "").replace(/<at>[^<]*<\/at>/gi, "").trim();
 }
-var hookFireRoutes = new Hono19();
+var hookFireRoutes = new Hono20();
 hookFireRoutes.post("/:token", async (c) => {
   const token = c.req.param("token");
   if (!tryConsume("hook:*", { max: 120, windowMs: 6e4 })) {
@@ -11913,9 +12451,9 @@ hookFireRoutes.post("/:token", async (c) => {
 });
 
 // src/definitions/routes.ts
-import { Hono as Hono20 } from "hono";
-import { v4 as uuid16 } from "uuid";
-var definitionRoutes = new Hono20();
+import { Hono as Hono21 } from "hono";
+import { v4 as uuid15 } from "uuid";
+var definitionRoutes = new Hono21();
 definitionRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -11994,7 +12532,7 @@ definitionRoutes.post("/", async (c) => {
       await applyUpdate(tx, existing.id);
       targetId = existing.id;
     } else {
-      targetId = uuid16();
+      targetId = uuid15();
       wasCreated = true;
       await tx.run(
         `INSERT INTO definitions (id, nest_id, term, definition, linked_tag, defined_by, created_at, updated_at)
@@ -12023,11 +12561,11 @@ definitionRoutes.delete("/:id", async (c) => {
 });
 
 // src/nests/asset-routes.ts
-import { Hono as Hono21 } from "hono";
-import { v4 as uuid17 } from "uuid";
-import { mkdir as mkdir2, readFile, writeFile } from "fs/promises";
-import { join as join4 } from "path";
-var assetRoutes = new Hono21();
+import { Hono as Hono22 } from "hono";
+import { v4 as uuid16 } from "uuid";
+import { mkdir as mkdir2, readFile as readFile2, writeFile } from "fs/promises";
+import { join as join6 } from "path";
+var assetRoutes = new Hono22();
 var CONTENT_TYPES = {
   png: "image/png",
   jpg: "image/jpeg",
@@ -12073,10 +12611,10 @@ assetRoutes.post("/", async (c) => {
       `${isVideo ? "video" : "image"} too large (${(file.size / (1024 * 1024)).toFixed(1)} MB, max ${maxBytes / (1024 * 1024)} MB for ${isVideo ? "video" : "images"})`
     );
   }
-  const name = `${uuid17()}.${ext === "jpeg" ? "jpg" : ext}`;
-  const dir = join4(resolveNestPath(nestId), "assets");
+  const name = `${uuid16()}.${ext === "jpeg" ? "jpg" : ext}`;
+  const dir = join6(resolveNestPath(nestId), "assets");
   await mkdir2(dir, { recursive: true });
-  await writeFile(join4(dir, name), Buffer.from(await file.arrayBuffer()));
+  await writeFile(join6(dir, name), Buffer.from(await file.arrayBuffer()));
   const url = `/nests/${nestId}/assets/${name}`;
   return c.json(
     {
@@ -12098,7 +12636,7 @@ assetRoutes.get("/:file", async (c) => {
   }
   let bytes;
   try {
-    bytes = await readFile(join4(resolveNestPath(nestId), "assets", name));
+    bytes = await readFile2(join6(resolveNestPath(nestId), "assets", name));
   } catch {
     throw new NotFoundError("Asset not found");
   }
@@ -12114,11 +12652,11 @@ assetRoutes.get("/:file", async (c) => {
 });
 
 // src/nodes/pdf-routes.ts
-import { Hono as Hono22 } from "hono";
+import { Hono as Hono23 } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { createHash as createHash3 } from "crypto";
 import { isPdf, readPdfBinary as readPdfBinary3 } from "@promptowl/contextnest-engine";
-var pdfNodeRoutes = new Hono22();
+var pdfNodeRoutes = new Hono23();
 var PDF_UPLOAD_PATH = /^\/nests\/[^/]+\/nodes\/pdf\/?$/;
 function pdfMaxRequestBytes() {
   return config.PDF_MAX_BYTES + 1024 * 1024;
@@ -12291,7 +12829,7 @@ pdfNodeRoutes.get("/:nodeId{.+}/pdf", async (c, next) => {
 });
 
 // src/auth/community-sites-routes.ts
-import { Hono as Hono23 } from "hono";
+import { Hono as Hono24 } from "hono";
 var serverAdminAllowed = async (c) => config.AUTH_MODE === "open" || await isServerAdminUserId(c.get("userId"));
 var isHttpUrl = (v) => /^https?:\/\/\S+$/i.test(v);
 var serializeSite = (site) => ({
@@ -12303,7 +12841,7 @@ var serializeSite = (site) => ({
   created_at: site.created_at,
   updated_at: site.updated_at
 });
-var communitySiteRoutes = new Hono23();
+var communitySiteRoutes = new Hono24();
 communitySiteRoutes.get("/", async (c) => {
   if (!await serverAdminAllowed(c))
     return c.json({ error: "Only the server admin can view this." }, 403);
@@ -12391,10 +12929,10 @@ communitySiteRoutes.delete("/:id", async (c) => {
 });
 
 // src/mcp/server-routes.ts
-import { Hono as Hono24 } from "hono";
+import { Hono as Hono25 } from "hono";
 import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport2 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 var SERVER_WRITE_TOOLS = /* @__PURE__ */ new Set([
   "nest_create",
   "context_create",
@@ -12593,7 +13131,7 @@ async function handleServerToolCall(toolName, args, userId, userEmail, nestScope
       );
       return `Created nest "${nest2.name}" (id: ${nest2.id}). Add documents with context_create, retrieve with the other tools.`;
     } catch (err) {
-      if (err instanceof ValidationError) return err.message;
+      if (err instanceof ValidationError || err instanceof ForbiddenError) return err.message;
       throw err;
     }
   }
@@ -12704,10 +13242,10 @@ function createServerMcp(userId, userEmail, nestScope, baseUrl, c) {
     const shape = {};
     for (const [key, def] of Object.entries(props)) {
       let field2;
-      if (def.type === "string") field2 = z2.string();
-      else if (def.type === "number") field2 = z2.number();
-      else if (def.type === "array") field2 = z2.array(z2.string());
-      else field2 = z2.any();
+      if (def.type === "string") field2 = z3.string();
+      else if (def.type === "number") field2 = z3.number();
+      else if (def.type === "array") field2 = z3.array(z3.string());
+      else field2 = z3.any();
       if (!required.includes(key)) field2 = field2.optional();
       shape[key] = field2;
     }
@@ -12727,7 +13265,7 @@ function createServerMcp(userId, userEmail, nestScope, baseUrl, c) {
   }
   return server;
 }
-var serverMcpRoutes = new Hono24();
+var serverMcpRoutes = new Hono25();
 serverMcpRoutes.all("/", async (c) => {
   const userId = c.get("userId");
   const userEmail = await getUserEmail3(userId);
@@ -12750,7 +13288,7 @@ serverMcpRoutes.all("/", async (c) => {
     await server.server.close();
   }
 });
-var nestIndexRoutes = new Hono24();
+var nestIndexRoutes = new Hono25();
 nestIndexRoutes.get("/", async (c) => {
   const userId = c.get("userId");
   const nests = await buildNestIndex(userId, c.get("nestScope"));
@@ -12926,14 +13464,14 @@ is \`ctx push --server ${B} --nest <nest-id>\` with the same env var set.
   through steward review before they become AI-visible.
 `;
 }
-var llmsTxtRoutes = new Hono24();
+var llmsTxtRoutes = new Hono25();
 llmsTxtRoutes.get("/", (c) => {
   const md = renderLlmsTxt(requestBaseUrl(c.req.url));
   return c.text(md, 200, { "Content-Type": "text/markdown; charset=utf-8" });
 });
 
 // src/governance/routes.ts
-import { Hono as Hono25 } from "hono";
+import { Hono as Hono26 } from "hono";
 
 // src/governance/feed-service.ts
 var SNIPPET_CHARS = 200;
@@ -13064,7 +13602,7 @@ async function getNestFeed(params) {
 }
 
 // src/governance/comment-service.ts
-import { v4 as uuid18 } from "uuid";
+import { v4 as uuid17 } from "uuid";
 async function createComment(params) {
   const db = getDb();
   const body = (params.body ?? "").trim();
@@ -13080,7 +13618,7 @@ async function createComment(params) {
       throw new Error("Parent comment not found on this node");
     }
   }
-  const id = uuid18();
+  const id = uuid17();
   await db.run(
     `INSERT INTO comments
        (id, nest_id, node_id, version, anchor_start, anchor_end, anchor_text,
@@ -13280,7 +13818,7 @@ function rowToComment(row) {
 
 // src/governance/stewards-parser.ts
 import { readFileSync as readFileSync3, existsSync } from "fs";
-import { join as join5 } from "path";
+import { join as join7 } from "path";
 function parseStewardsYaml(content) {
   const result = { version: 1 };
   const lines = content.split("\n");
@@ -13346,9 +13884,9 @@ function parseEntry(str) {
 function loadStewardsConfig(nestId) {
   const nestPath = resolveNestPath(nestId);
   const candidates = [
-    join5(nestPath, "stewards.yaml"),
-    join5(nestPath, "stewards.yml"),
-    join5(nestPath, ".context", "stewards.yaml")
+    join7(nestPath, "stewards.yaml"),
+    join7(nestPath, "stewards.yml"),
+    join7(nestPath, ".context", "stewards.yaml")
   ];
   for (const candidatePath of candidates) {
     if (existsSync(candidatePath)) {
@@ -13365,7 +13903,7 @@ function parseLimit(raw, def = 100, max = 1e3) {
   if (Number.isNaN(n) || n < 1) return def;
   return Math.min(n, max);
 }
-var governanceRoutes = new Hono25();
+var governanceRoutes = new Hono26();
 governanceRoutes.get("/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const scope = c.req.query("scope");
@@ -13609,7 +14147,7 @@ governanceRoutes.post("/request-deletion", async (c) => {
   if (body.targetType === "folder") {
     const { storage } = await engineCache.get(nestId);
     const docs = await storage.discoverDocuments();
-    if (!docs.some((d) => isIdUnderFolder(d.id, target))) {
+    if (!docs.some((d) => isIdUnderFolder(d.id, target)) && !await vaultFolderExists(nestId, target)) {
       return c.json({ error: `Folder not found: ${target}` }, 404);
     }
   }
@@ -13735,7 +14273,7 @@ governanceRoutes.get("/activity", async (c) => {
   const activity = await getActivity({ nestId, limit });
   return c.json({ activity });
 });
-var governanceNodeRoutes = new Hono25();
+var governanceNodeRoutes = new Hono26();
 governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -14230,23 +14768,29 @@ function publicBaseUrlError(value) {
 // src/app.ts
 import { serveStatic } from "@hono/node-server/serve-static";
 import { fileURLToPath } from "url";
-import { dirname as dirname2, join as join6, relative as relative2 } from "path";
+import { dirname as dirname2, join as join8, relative as relative2 } from "path";
 import { existsSync as existsSync2, readFileSync as readFileSync4 } from "fs";
 var HERE = dirname2(fileURLToPath(import.meta.url));
 var SERVICE_VERSION = (() => {
   try {
-    return JSON.parse(readFileSync4(join6(HERE, "..", "package.json"), "utf8")).version;
+    return JSON.parse(readFileSync4(join8(HERE, "..", "package.json"), "utf8")).version;
   } catch {
     return "unknown";
   }
 })();
 var UI_DIR_CANDIDATES = [
-  join6(HERE, "web3"),
-  join6(process.cwd(), "dist", "web3")
+  join8(HERE, "web3"),
+  join8(process.cwd(), "dist", "web3")
 ];
 var UI_DIR_ABS = UI_DIR_CANDIDATES.find((p) => existsSync2(p)) || UI_DIR_CANDIDATES[0];
 var UI_DIR_REL = relative2(process.cwd(), UI_DIR_ABS) || ".";
-var openModeMiddleware = createMiddleware2(async (c, next) => {
+var isDocumentNavigation = (c) => c.req.header("Sec-Fetch-Mode") === "navigate" || (c.req.header("Accept") || "").includes("text/html");
+var serveIndexShell = serveStatic({
+  root: UI_DIR_REL,
+  path: "index.html",
+  onFound: (_p, c) => c.header("Cache-Control", "no-cache")
+});
+var openModeMiddleware = createMiddleware3(async (c, next) => {
   const anonId = await ensureAnonymousUser();
   c.set("userId", anonId);
   c.set("nestScope", null);
@@ -14258,7 +14802,7 @@ function isPublicReadEligiblePath(method, path) {
   if (/^\/nests\/[^/]+\/stewards/.test(path)) return false;
   return !/\/(collaborators|visibility|settings|mcp)/.test(path);
 }
-var flexAuthMiddleware = createMiddleware2(async (c, next) => {
+var flexAuthMiddleware = createMiddleware3(async (c, next) => {
   const hasBearer = c.req.header("Authorization")?.startsWith("Bearer cnst_");
   const hasCookie = !!c.req.header("Cookie")?.includes("cnst_session=");
   if (hasBearer || hasCookie) {
@@ -14284,7 +14828,7 @@ var flexAuthMiddleware = createMiddleware2(async (c, next) => {
 function nestPathParts(path) {
   return path.replace(/^\/nests\//, "").split("/").filter(Boolean);
 }
-var flexAuthWithPromptowlTicket = createMiddleware2(
+var flexAuthWithPromptowlTicket = createMiddleware3(
   async (c, next) => {
     const header = c.req.header("Authorization") || "";
     const token = header.startsWith("Bearer ") ? header.slice("Bearer ".length) : "";
@@ -14361,7 +14905,7 @@ async function canApproveInNest(nestId, email) {
   return ok;
 }
 function createApp() {
-  const app = new Hono26({ router: new LinearRouter() });
+  const app = new Hono27({ router: new LinearRouter() });
   const corsOrigins = config.CORS_ORIGINS;
   app.use(
     "*",
@@ -14411,6 +14955,7 @@ function createApp() {
       client: c.get("clientMetadata")
     });
   });
+  app.use("*", nestScopedKeyGuard);
   app.get("/health", (c) => {
     const oidcReady = isOidcReady();
     return c.json({
@@ -14425,6 +14970,9 @@ function createApp() {
       // Presence only: the publish dialog hides the email/invite gates when
       // this server cannot send mail, because their only way in is a mailed link.
       email_configured: isEmailConfigured(),
+      // Who may create nests (admins | everyone) — the Nests page hides the
+      // create buttons from non-admins when it's admins-only.
+      nest_creation: config.NEST_CREATION,
       // Product analytics for the SPA. The PostHog project key is a public
       // client key, but it only ships while usage telemetry is on — one switch
       // covers everything this server sends outward.
@@ -14580,6 +15128,7 @@ function createApp() {
     oidc_allowed_domains: config.OIDC_ALLOWED_DOMAINS.join(", "),
     oidc_auto_provision: config.OIDC_AUTO_PROVISION,
     oidc_department_tagging: config.OIDC_DEPARTMENT_TAGGING,
+    nest_creation: config.NEST_CREATION,
     people_suggest_all_users: config.PEOPLE_SUGGEST_ALL_USERS,
     shared_deployment: config.SHARED_DEPLOYMENT,
     // Agent SSO / token-exchange. MCP_SIGNING_SECRET is WRITE-ONLY — only its
@@ -14601,7 +15150,12 @@ function createApp() {
     anthropic_api_key_masked: process.env.ANTHROPIC_API_KEY ? `\u2022\u2022\u2022\u2022${process.env.ANTHROPIC_API_KEY.slice(-4)}` : null,
     slack_webhook_url: config.SLACK_WEBHOOK_URL ?? "",
     msteams_webhook_url: config.MSTEAMS_WEBHOOK_URL ?? "",
+    email_provider: config.EMAIL_PROVIDER,
     smtp_url: config.SMTP_URL ?? "",
+    ses_region: config.SES_REGION ?? "",
+    ses_access_key_id: config.SES_ACCESS_KEY_ID ?? "",
+    // Write-only, like the OIDC secret — presence only, never the value.
+    ses_secret_access_key_set: !!config.SES_SECRET_ACCESS_KEY,
     notify_email_from: config.NOTIFY_EMAIL_FROM ?? "",
     notify_email_to: config.NOTIFY_EMAIL_TO ?? ""
   });
@@ -14806,6 +15360,12 @@ function createApp() {
         value: body.oidc_department_tagging ? "true" : null
       });
     }
+    if ("nest_creation" in body) {
+      const v = String(body.nest_creation ?? "").trim().toLowerCase();
+      if (v !== "admins" && v !== "everyone")
+        addError("nest_creation", "Nest creation must be admins or everyone.");
+      else pending.push({ name: "NEST_CREATION", value: v });
+    }
     if ("people_suggest_all_users" in body) {
       pending.push({
         name: "PEOPLE_SUGGEST_ALL_USERS",
@@ -14915,6 +15475,50 @@ function createApp() {
         addError("smtp_url", "SMTP connection URL must start with smtp:// or smtps:// (or leave it empty to turn email notifications off).");
       else pending.push({ name: "SMTP_URL", value: v || null });
     }
+    if ("email_provider" in body) {
+      const v = String(body.email_provider ?? "").trim().toLowerCase();
+      if (v !== "smtp" && v !== "ses")
+        addError("email_provider", "Email provider must be SMTP or AWS SES.");
+      else pending.push({ name: "EMAIL_PROVIDER", value: v });
+    }
+    if ("ses_region" in body) {
+      const v = String(body.ses_region ?? "").trim();
+      if (v && !/^[a-z]{2}(-[a-z]+)+-\d+$/.test(v))
+        addError("ses_region", "AWS region must look like us-east-1.");
+      else pending.push({ name: "SES_REGION", value: v || null });
+    }
+    if ("ses_access_key_id" in body) {
+      const v = String(body.ses_access_key_id ?? "").trim();
+      pending.push({ name: "SES_ACCESS_KEY_ID", value: v || null });
+    }
+    if ("ses_secret_access_key" in body) {
+      const v = body.ses_secret_access_key;
+      if (v !== null && typeof v !== "string")
+        addError("ses_secret_access_key", "AWS secret access key must be a string (or empty to clear it).");
+      else pending.push({ name: "SES_SECRET_ACCESS_KEY", value: v?.trim() || null });
+    }
+    const provider = String(body.email_provider ?? "").trim().toLowerCase();
+    if (provider === "smtp" || provider === "ses") {
+      const stale = provider === "ses" ? ["SMTP_URL"] : ["SES_REGION", "SES_ACCESS_KEY_ID", "SES_SECRET_ACCESS_KEY"];
+      for (const name of stale) {
+        const i = pending.findIndex((p) => p.name === name);
+        if (i >= 0) pending.splice(i, 1);
+        pending.push({ name, value: null });
+      }
+    }
+    if ("ses_access_key_id" in body || "ses_secret_access_key" in body) {
+      const next = (name, current) => {
+        const p = pending.find((x) => x.name === name);
+        return p ? p.value : current;
+      };
+      const hasId = !!next("SES_ACCESS_KEY_ID", config.SES_ACCESS_KEY_ID);
+      const hasSecret = !!next("SES_SECRET_ACCESS_KEY", config.SES_SECRET_ACCESS_KEY);
+      if (hasId !== hasSecret)
+        addError(
+          "ses_access_key_id",
+          "Set both the AWS access key ID and secret access key, or leave both empty to use the server's IAM role."
+        );
+    }
     if ("notify_email_from" in body) {
       const v = String(body.notify_email_from ?? "").trim();
       if (v && v.includes(","))
@@ -14952,15 +15556,18 @@ function createApp() {
         { error: errorMessages.join("; "), fieldErrors, settings: currentServerSettings() },
         400
       );
-    const smtpChange = pending.find((p) => p.name === "SMTP_URL");
-    if (smtpChange && smtpChange.value) {
-      const result = await verifySmtp(smtpChange.value);
+    const over = Object.fromEntries(pending.map((p) => [p.name, p.value]));
+    const nextEmail = transportSettings(over);
+    const emailFields = nextEmail?.provider === "ses" ? ["EMAIL_PROVIDER", "SES_REGION", "SES_ACCESS_KEY_ID", "SES_SECRET_ACCESS_KEY"] : ["EMAIL_PROVIDER", "SMTP_URL"];
+    if (nextEmail && emailFields.some((k) => k in over)) {
+      const result = await verifyEmailTransport(nextEmail);
       if (!result.ok) {
-        const message = `SMTP connection failed: ${result.error}`;
+        const ses = nextEmail.provider === "ses";
+        const message = `${ses ? "AWS SES" : "SMTP"} connection failed: ${result.error}`;
         return c.json(
           {
             error: message,
-            fieldErrors: { smtp_url: message },
+            fieldErrors: { [ses ? "ses_region" : "smtp_url"]: message },
             settings: currentServerSettings()
           },
           400
@@ -15119,6 +15726,10 @@ function createApp() {
   app.use("/admin/community-sites", flexAuthMiddleware);
   app.use("/admin/community-sites/*", flexAuthMiddleware);
   app.route("/admin/community-sites", communitySiteRoutes);
+  app.get("/teams", async (c, next) => {
+    if (isDocumentNavigation(c)) return serveIndexShell(c, next);
+    return next();
+  });
   app.use("/teams/*", flexAuthMiddleware);
   app.use("/teams", flexAuthMiddleware);
   app.route("/teams", teamRoutes);
@@ -15172,7 +15783,7 @@ function createApp() {
     const others = requests.filter((r) => r.requestedBy !== me);
     const nestApprove = new Map(
       await Promise.all(
-        [...new Set(others.map((r) => r.nestId))].map(
+        [...nestName2.keys()].map(
           async (nestId) => [
             nestId,
             await canApproveInNest(nestId, me)
@@ -15202,13 +15813,33 @@ function createApp() {
     );
     waiting.sort(byNewest);
     const notifications = await listNotifications(me, { unreadOnly: true, limit: 50 });
+    const approvableNestIds = [...nestName2.keys()].filter(
+      (id) => nestApprove.get(id)
+    );
+    const restNestIds = [...nestName2.keys()].filter(
+      (id) => !nestApprove.get(id)
+    );
+    const [{ total: approvableReviewTotal }, { total: myReviewsElsewhereTotal }] = await Promise.all([
+      getReviewQueue({ status: "pending", nestIds: approvableNestIds, limit: 1 }),
+      getReviewQueue({
+        status: "pending",
+        nestIds: restNestIds,
+        requestedByEmail: me,
+        limit: 1
+      })
+    ]);
+    const reviewTotal = approvableReviewTotal + myReviewsElsewhereTotal;
+    const deletionsShown = items.filter((i) => i.type === "deletion").length + waiting.filter((i) => i.type === "deletion").length;
     return c.json({
       items,
       waiting,
       notifications,
-      // total = all pending across visible nests (both buckets); has_more drives
-      // the "Load more" control on the client.
-      pagination: { total, limit, offset, has_more: offset + requests.length < total }
+      pagination: {
+        total: reviewTotal + deletionsShown,
+        limit,
+        offset,
+        has_more: offset + requests.length < total
+      }
     });
   });
   app.get("/me/drafts", async (c) => {
@@ -15257,12 +15888,29 @@ function createApp() {
     await markNotificationsRead(me, body.ids === "all" ? "all" : body.ids ?? []);
     return c.json({ ok: true });
   });
+  app.post("/me/nests/:nestId/leave", async (c) => {
+    const nestId = c.req.param("nestId");
+    const me = await resolveCallerEmail(c.get("userId"));
+    const db = getDb();
+    const info = await db.run(
+      "DELETE FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
+      [nestId, c.get("userId")]
+    );
+    await db.run(
+      `UPDATE notifications SET read_at = ? WHERE LOWER(user_email) = LOWER(?) AND nest_id = ? AND kind = 'nest_invite' AND read_at IS NULL`,
+      [(/* @__PURE__ */ new Date()).toISOString(), me, nestId]
+    );
+    return c.json({ left: info.changes > 0 });
+  });
   app.use("/stats", flexAuthMiddleware);
   app.get("/stats", async (c) => {
     const db = getDb();
     const userId = c.get("userId");
     const userEmail = await resolveCallerEmail(userId);
-    const visibleNests = await listVisibleNests(userId);
+    const nestScope = c.get("nestScope");
+    const visibleNests = (await listVisibleNests(userId)).filter(
+      (n) => !nestScope || n.id === nestScope
+    );
     let documents = 0;
     for (const nest of visibleNests) {
       try {
@@ -15290,8 +15938,12 @@ function createApp() {
     const limit = Math.min(Math.max(Number(c.req.query("limit")) || 20, 1), 50);
     const userId = c.get("userId");
     const userEmail = await resolveCallerEmail(userId);
+    const nestScope = c.get("nestScope");
+    const searchable = (await listVisibleNests(userId, { readable: true })).filter(
+      (n) => !nestScope || n.id === nestScope
+    );
     const perNest = await Promise.all(
-      (await listVisibleNests(userId, { readable: true })).map(async (nest) => {
+      searchable.map(async (nest) => {
         try {
           const { storage } = await engineCache.get(nest.id);
           const matches = matchDocuments(await discoverForSearch(storage), q);
@@ -15324,7 +15976,7 @@ function createApp() {
   app.route("/index", nestIndexRoutes);
   app.use("/mcp", flexAuthWithPromptowlTicket);
   app.route("/mcp", serverMcpRoutes);
-  const nestsApp = new Hono26();
+  const nestsApp = new Hono27();
   nestsApp.use("*", async (c, next) => {
     const parts = nestPathParts(c.req.path);
     const ticketEligible = parts.length === 2 && (c.req.method === "POST" && parts[1] === "context" || c.req.method === "GET" && parts[1] === "nodes" || parts[1] === "mcp");
@@ -15454,7 +16106,7 @@ function createApp() {
       );
     }
     const resource = parts[1];
-    if (resource === "visibility" || resource === "reader-mode") {
+    if (resource === "visibility" || resource === "reader-mode" || resource === "branding") {
       required = "admin";
     } else if (resource === "collaborators") {
       required = c.req.method === "GET" || c.req.method === "POST" ? "write" : "admin";
@@ -15551,6 +16203,7 @@ function createApp() {
   nestsApp.route("/:nestId/nodes", nodeRoutes);
   nestsApp.route("/:nestId", queryRoutes);
   nestsApp.route("/:nestId", sharingRoutes);
+  nestsApp.route("/:nestId", brandingRoutes);
   nestsApp.route("/:nestId/grants", grantRoutes);
   nestsApp.route("/:nestId/publications", publishRoutes);
   nestsApp.route("/:nestId/teams", nestTeamRoutes);
@@ -15574,18 +16227,13 @@ function createApp() {
       onFound: (_p, c) => c.header("Cache-Control", "public, max-age=31536000, immutable")
     })
   );
-  const isDocumentNavigation = (c) => c.req.header("Sec-Fetch-Mode") === "navigate" || (c.req.header("Accept") || "").includes("text/html");
   app.get(
     "*",
     async (c, next) => {
       if (isDocumentNavigation(c)) return next();
       return c.json({ error: "Not found" }, 404);
     },
-    serveStatic({
-      root: UI_DIR_REL,
-      path: "index.html",
-      onFound: (_p, c) => c.header("Cache-Control", "no-cache")
-    })
+    serveIndexShell
   );
   app.notFound((c) => c.json({ error: "Not found" }, 404));
   app.onError((err, c) => {
@@ -15873,7 +16521,7 @@ async function repairGraftedVersionChains(db) {
 }
 
 // src/workflow/scheduler.ts
-import { v4 as uuid19 } from "uuid";
+import { v4 as uuid18 } from "uuid";
 function isDue(s, now) {
   if (!s.last_run_at) return true;
   const last = Date.parse(s.last_run_at);
@@ -15901,7 +16549,7 @@ async function schedulerTick(now = Date.now()) {
         );
         continue;
       }
-      const id = `run_${uuid19()}`;
+      const id = `run_${uuid18()}`;
       const nowIso2 = new Date(now).toISOString();
       await db.run(
         `INSERT INTO runs (id, nest_id, agent_node, triggered_by, status, inputs, started_at, parent_run_id, depth)